<?php if (!defined('DASHBOARD_ROOT')) { http_response_code(403); exit; } if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['_sec_action'] ?? '') !== '') { while (ob_get_level()) { ob_end_clean(); } header('Content-Type: application/json'); CSRF::enforce(); $act = $_POST['_sec_action']; $aid = $_SESSION['admin_id'] ?? 0; if ($act === 'load_overview') { $secToday = 0; try { $secToday = (int)Database::scalar("SELECT COUNT(*) FROM events WHERE category = 'security' AND DATE(created_at) = CURDATE()") ?: 0; } catch (\Throwable $e) {} $wdToday = 0; try { $wdToday = (int)Database::scalar("SELECT COUNT(*) FROM sec_watchdog_events WHERE DATE(created_at) = CURDATE()"); } catch (\Throwable $e) {} $ipChanges = 0; try { $ipChanges = (int)Database::scalar("SELECT COUNT(*) FROM sec_session_ip_changes WHERE DATE(created_at) = CURDATE()"); } catch (\Throwable $e) {} $hpToday = 0; try { $hpToday = (int)Database::scalar("SELECT COUNT(*) FROM honeypot_hits WHERE DATE(created_at) = CURDATE()"); } catch (\Throwable $e) {} $hpTotal = 0; try { $hpTotal = (int)Database::scalar("SELECT COUNT(*) FROM honeypot_hits"); } catch (\Throwable $e) {} $vsActive = 0; $vsTotal = 0; try { $vsTotal = (int)Database::scalar("SELECT COUNT(*) FROM sec_visitor_sessions"); } catch (\Throwable $e) {} $highRisk = 0; $recentEvents = []; try { $recentEvents = Database::fetchAll("SELECT id, action, target_type, target_id, ip_address, created_at FROM events ORDER BY created_at DESC LIMIT 20"); } catch (\Throwable $e) {} $threats = []; exit(json_encode(['ok'=>true,'secToday'=>$secToday,'wdToday'=>$wdToday,'ipChanges'=>$ipChanges,'hpToday'=>$hpToday,'hpTotal'=>$hpTotal,'vsActive'=>$vsActive,'vsTotal'=>$vsTotal,'highRisk'=>$highRisk,'events'=>$recentEvents,'threats'=>$threats])); } if ($act === 'load_honeypots') { $hits = []; try { $hits = Database::fetchAll("SELECT id, ip_address, trap_route, request_method, created_at FROM honeypot_hits ORDER BY created_at DESC LIMIT 50"); } catch (\Throwable $e) {} $byRoute = []; try { $byRoute = Database::fetchAll("SELECT trap_route, COUNT(*) as cnt FROM honeypot_hits GROUP BY trap_route ORDER BY cnt DESC LIMIT 10"); } catch (\Throwable $e) {} $byIp = []; try { $byIp = Database::fetchAll("SELECT ip_address, COUNT(*) as cnt FROM honeypot_hits GROUP BY ip_address ORDER BY cnt DESC LIMIT 10"); } catch (\Throwable $e) {} exit(json_encode(['ok'=>true,'hits'=>$hits,'byRoute'=>$byRoute,'byIp'=>$byIp])); } if ($act === 'load_scraping') { $scrapers = []; try { $scrapers = Database::fetchAll("SELECT id, action, ip_address, meta, created_at FROM events WHERE category = 'security' AND (action LIKE '%scrape%' OR action LIKE '%rate%' OR action LIKE '%bot%' OR action LIKE '%crawl%') ORDER BY created_at DESC LIMIT 30"); } catch (\Throwable $e) {} $ipLogs = []; try { $ipLogs = Database::fetchAll("SELECT ip_address, COUNT(*) as cnt, MAX(created_at) as last_seen FROM customer_ip_logs GROUP BY ip_address ORDER BY cnt DESC LIMIT 15"); } catch (\Throwable $e) {} exit(json_encode(['ok'=>true,'scrapers'=>$scrapers,'ipLogs'=>$ipLogs])); } if ($act === 'load_integrity') { $cspViolations = []; try { $cspViolations = Database::fetchAll("SELECT id, action, ip_address, meta, created_at FROM events WHERE category = 'security' AND (action LIKE '%csp%' OR action LIKE '%integrity%' OR action LIKE '%manipulation%' OR action LIKE '%source%') ORDER BY created_at DESC LIMIT 30"); } catch (\Throwable $e) {} $srcViews = []; exit(json_encode(['ok'=>true,'cspViolations'=>$cspViolations,'srcViews'=>$srcViews])); } if ($act === 'load_access') { $watchdog = []; try { $watchdog = Database::fetchAll("SELECT id, event_type, severity, ip_address, details, created_at FROM sec_watchdog_events ORDER BY created_at DESC LIMIT 30"); } catch (\Throwable $e) {} $lockdowns = []; exit(json_encode(['ok'=>true,'watchdog'=>$watchdog,'lockdowns'=>$lockdowns])); } if ($act === 'load_audit') { $audit = []; try { $audit = Database::fetchAll("SELECT id, admin_id, action, target_type, target_id, ip_address, created_at FROM events ORDER BY created_at DESC LIMIT 40"); } catch (\Throwable $e) {} exit(json_encode(['ok'=>true,'audit'=>$audit])); } if ($act === 'load_master') { ob_start(); require DASHBOARD_ROOT . '/modules/security/trust_master_panel.php'; $html = ob_get_clean(); exit(json_encode(['ok'=>true,'html'=>$html])); } if ($act === 'load_trust') { ob_start(); require DASHBOARD_ROOT . '/modules/security/trust_monitor.php'; $html = ob_get_clean(); exit(json_encode(['ok'=>true,'html'=>$html])); } exit(json_encode(['ok'=>false,'error'=>'Unknown action'])); } 